Add plugin type for ServerAttestor

[kfox1111]

No description provided.

[sorindumitru]

How is the insecure_bootstrap intended to be used? Doesn't the agent not verify the server in the case of insecure bootstrapping? Would it even reach out to these plugins in that case?

[kfox1111]

spiffe/spire#5881

To implement:

plugins {
    TrustBundleSource "insecure" {}
}

The plugin would just have a GetTrustBundle function that does:
return nil, true

The plugin would be able to determine if it wanted to insecurely bootstrap and pass that on to be done. Doing it at the plugin level would allow a policy plugin to be written that does some logic before falling back to an insecure bootstrap.

[kfox1111]

Basically, the plugin would get called right before attestation to determine what to do (https://github.com/kfox1111/spire/blob/rebootstrap/pkg/agent/agent.go#L129-L132)

		BootstrapTrustBundle, InsecureBootstrap, err = a.c.TrustBundleSources.GetBundle()
	}
	if err == nil {
		as, err = a.attest(ctx, sto, cat, metrics, nodeAttestor, BootstrapTrustBundle, InsecureBootstrap)

[sorindumitru]

How is the plugin using this information? Some of these seem like plugin specific configuration, which can be done through the plugin data config, for example the server url which wouldn't be used for a file based bundle source.

[kfox1111]

Its metadata that plugin might want to use in its calculation for returning trust bundles / insecure mode, but it doesn't have to.

For example, a plugin that just reads from a file can ignore all of this.

A policy plugin may want to look at these things to determine, pull from source A if its attempted less then 10 connections, then use source B. Or, if now() > starttime + 10m, use source C. Or another plugin may call out to an external url to do the logic, and pass along trustdomain/server_url info so one external service could handle lots of different instances. (some kind of trust bundle as a service thing)